Starstruk Logo MarkStarstruk

v3.13.0

sinewaveai/agent-security-scanner-mcpv3.13.0Feb 24, 2026by sinewaveai

AI Summary

This release consolidates 8 dependency updates including critical security fixes for CVE-2025-69873 (ajv ReDoS) and GHSA-345p-7cg4-v4c7 (MCP SDK cross-client data leak), along with significant performance improvements via Hono's trie-router optimization.

Key Highlights

  • Security fixes for CVE-2025-69873 (ajv ReDoS attacks) and GHSA-345p-7cg4-v4c7 (MCP SDK cross-client data leak)
  • 1.5x-2x faster router performance via Hono trie-router optimization
  • AJV tree-shaking for smaller bundle sizes
  • 8 dependency updates across main and mcp-server-full packages
  • 419 tests passed, fully backward compatible

New Features

  • Hono $path() method for client routing
  • Hono ApplyGlobalResponse type helper
  • QS strictMerge option for object/primitive conflicts
  • MCP SDK OAuth client credentials scopes support

Full Release Notes

## 🚀 What's New in v3.13.0

This release consolidates 8 dependency updates including critical security fixes and major performance improvements.

### 🔒 Security Fixes

- **ajv 8.17.1 → 8.18.0** - Fixes **CVE-2025-69873** (ReDoS attacks mitigation)
- **@modelcontextprotocol/sdk 1.25.3 → 1.26.0** - Fixes **GHSA-345p-7cg4-v4c7** (cross-client data leak)

### ⚡ Performance

- **hono 4.11.7 → 4.12.1** - **1.5x-2x faster** router performance via trie-router optimization
- **AJV tree-shaking** - Smaller bundle sizes with `sideEffects: false`

### 📦 Dependencies Updated

- `hono`: 4.11.7 → 4.12.1 (main + mcp-server-full)
- `ajv`: 8.17.1 → 8.18.0 (main + mcp-server-full)
- `qs`: 6.14.1 → 6.15.0 (main + mcp-server-full)
- `@modelcontextprotocol/sdk`: 1.25.3 → 1.26.0 (main + mcp-server-full)

### 🛠️ New Features

- **Hono**: `$path()` method for client, `ApplyGlobalResponse` type helper
- **QS**: `strictMerge` option for object/primitive conflicts
- **MCP SDK**: OAuth client credentials scopes support

### 🐛 Bug Fixes

- AJV: Infinity and NaN serialization to null
- QS: `duplicates` option handling for bracket notation
- MCP SDK: npm audit vulnerabilities resolved

---

## 📥 Installation

```bash
npm install -g agent-security-scanner-mcp@latest
```

## 🔗 Links

- **Full Changelog**: https://github.com/sinewaveai/agent-security-scanner-mcp/compare/v3.12.0...v3.13.0
- **npm Package**: https://www.npmjs.com/package/agent-security-scanner-mcp
- **MCP Registry**: https://registry.modelcontextprotocol.io/

---

**All 8 PRs merged**: #4, #9, #10, #11, #13, #14, #17, #18
**Tests**: 419 passed
**Breaking Changes**: None - fully backward compatible